sprites-dev

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to execute code downloaded from a remote URL directly into a shell. Specifically: curl -fsSL https://raw.githubusercontent.com/kylelundstedt/dotfiles/master/install.sh | bash. This is a high-risk pattern that allows a remote third party to execute arbitrary code on the target system without prior review or integrity verification.
  • [EXTERNAL_DOWNLOADS]: The skill downloads an installation script from an external GitHub repository (kylelundstedt/dotfiles) which is not an officially trusted organization or well-known vendor service. This increases the risk of supply chain attacks or malicious updates to the script.
  • [COMMAND_EXECUTION]: The skill heavily utilizes sprite exec and bash -c to perform various administrative tasks, including lifecycle management and environment setup, which are combined with the aforementioned remote code execution risk.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/kylelundstedt/dotfiles/master/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 16, 2026, 12:12 AM